System for controlling the operation of modules using information transmitted from a control device via a data bus, a trigger device and a test circuit

ABSTRACT

In a data communication system, data is transmitted from a control device ( 2 ) to a communication interface ( 6 ) and from there via a communication bus ( 8 ) to additional communication interfaces ( 12 ) of trigger devices ( 9, 10 ). The communication interface ( 6 ) on the control device side has inputs, to which signals from said control device ( 2 ) and a disarming switch ( 26 ) can be assigned. The disarming switch can be circumvented by a bypass switch ( 34 ) which is controlled by the control device. The state of the signal at the inputs of the communication interface on the control device side ( 6 ) is transmitted to corresponding outputs of the communication interfaces ( 12 ) of the trigger devices. A trigger device has a safety unit which is used to test at least one trigger unit, when the state of the signal of the outputs authorises such a test and the trigger voltage source is not yet charged with the full trigger voltage. In said state, the safety unit also blocks triggering as soon as the trigger voltage has been reached. The inventive system ensures a high degree of functional safety and flexibility.

DESCRIPTION

[0001] System for controlling the operation of modules by transmittinginformation from a control device via a databus, and firing device andtest circuit

[0002] The invention relates to a system for controlling the operationof modules by transmitting information from a control device via adatabus, in particular for controlling the operation of firing devicesof a vehicle occupant protection apparatus in a motor vehicle, accordingto the preamble of claim 1. The invention also relates to a firingdevice for connection to the communications bus of such a system and asafety circuit for a firing device of a vehicle occupant protectionsystem.

[0003] A system of the generic type is known from DE 197 39 808 Al. Inthis system, the code words which are transmitted from the controldevice to the communications interface contain an information sectionand an error-detection section which contains, for example, the sum ofbits of the information section. The information packet contains a bitwhich corresponds to the presence or non-presence of a safing signalgenerated by a safing switch or safing sensor. If the code wordtransmitted by the control device is to fire firing devices of a motorvehicle occupant protection system, it contains, at a predeterminedplace in the information packet, a bit which corresponds to the presenceof the safing signal, i.e. requires the safing switch to be closed. Thisinformation bit is replaced in the communications interface by theinformation relating to the safing signal which is actually present atthe safing input so that, for example when there is informationcontained in the code word relating to the closed safing switch but whenthere is an absence of the safing signal at the safing input of thecommunications interface, the sum value in the code word no longercorresponds to the sum of the information packet and the code word canbe detected as faulty, as a result of which the firing devices do notfire.

[0004] In the know system, the safing signal which is present at thesafing input thus permits a safing function to be integrated into airbagfiring systems which operate with bus systems. when the safing switch isopened, firing is reliably prevented. However, in the known system, itis not possible to distinguish between firing instructions for differentfiring devices, for example firing devices for side airbags and firingdevices for front airbags. Furthermore, all the firing devices can befired only if the safing switch is closed.

[0005] The invention is based on the object of developing a system ofthe generic type in such a way that a large degree of flexibility andreliability in terms of the actuation capability of the individualmodules is provided.

[0006] A first solution of this object is provided with a systemaccording to claim 1.

[0007] By virtue of the fact that the system according to the inventionhas, at the control-device-end communications interface, a plurality ofinputs whose signal assignment is transmitted to corresponding outputsof the module-end communications interface, information is present atthe module end which can be used in a wide variety of ways to enable anddisable functions which are to be triggered by means of the datatransmitted by the control module. In this way, flexible actuation ofthe individual module is possible. The transmission of the transmitteddata and the information in the code words can be protected in a similarway to that in the method according to DE 197 39 808, mentioned at thebeginning, check bits contained in the code words for checking thecorrectness of the information both increasing the reliability of thetransmission and enabling faults of the control device to be detected.The number of inputs of the control-device-end communications interfaceto which signals can be applied can be different from the number of themodule-end communications interface.

[0008] By means of the features of claim 2, it is possible to enablefunctions of the modules as a function of the switch state of the safingswitch.

[0009] According to claim 3, the modules can advantageously be addressedselectively by means of module-specific codes, as a result of which theflexibility and reliability of their actuation capability is increasedfurther.

[0010] A further solution of the object according to the invention whichcan be combined with the aforementioned solution is achieved by a systemaccording to claim 4.

[0011] With the embodiment of the system according to claim 4 it ispossible to bring about a signal state which corresponds, on the onehand, to the closed safing switch, as a result of which specificfunctions are enabled, and which corresponds, on the other hand, to thesafing switch closed by means of a test signal, and in addition to thepresence of a test signal, as a result of which functions, in particulartest functions in which one or more modules are in the same enabledstate as in the case of a closed safing switch, can take place.

[0012] The test output, which is additionally present separatelyaccording to claim 5, of the module-end communications interface permitsselective execution of functional scopes, irrespective of the state ofother outputs which are present.

[0013] The features of claim 6 provide a way of triggering theindividual safety devices for a vehicle occupant protection system of avehicle which is suitable for practical conditions.

[0014] The features of claim 7 provide a large degree of reliability ofthe triggering of the safety devices to be triggered in the event of afront-end impact against malfunctions of the control device. Inaddition, as is explained further below, the safety devices which are tobe triggered in the event of a front-end impact can be checked.

[0015] Claims 8 and 9 are aimed at an embodiment of the system in whichno separate test input of the control-device-end communicationsinterface is provided.

[0016] The feature of claim 10 permits additional functional reliabilityadvantages to be obtained by virtue of the fact that, for example, afiring signal is generated in the control device only if the safinginput has experienced a level change.

[0017] Claim 11 is aimed at the basic design of a first advantageousembodiment of a firing device for connection to the communications busof the system according to the invention. The embodiment of the firingdevice according to the invention ensures that a plurality of identicalfiring devices, embodied as what are referred to as “smart squibbs”, canbe connected to the communications bus and selectively triggered.

[0018] Claim 12 characterizes a further embodiment of a firing devicewith whose safety circuit it is possible to carry out functionalchecking as long as the firing voltage source is still not charged toits firing voltage. If a test signal is present at the same time as acontrol signal, firing of the firing device is prevented.

[0019] The features of claims 11 and 12 may be present together.

[0020] According to claim 13, the safety switch, which constitutes acentral safety element of the system, is advantageously monitored.

[0021] Claim 14 is aimed per se at the embodiment of the safety circuit.

[0022] The invention is suitable for all systems of the generic type inwhich slave modules are to be controlled by a master module via adatabus as flexibly as possible and with a high degree of functionalreliability. The invention is particularly suitable for use in vehicleoccupant protection systems, with reference to which it is explainedfurther below by way of example and with further details. In thedrawing:

[0023]FIG. 1 shows a block circuit diagram of a first embodiment of thesystem according to the invention,

[0024]FIG. 2 shows a block circuit diagram of a firing device,

[0025]FIG. 3 shows a circuit diagram explaining the function of thefiring device according to FIG. 2, and

[0026]FIG. 4 shows a block circuit diagram of a second embodiment of thesystem.

[0027] According to FIG. 1, a control device 2 of a vehicle occupantprotection system is connected via a data line 4 to a communicationsinterface 6 which is connected to firing devices 9, 10 via acommunications bus 8. The firing devices are embodied as what arereferred to as “smart squibbs” which have their own communicationsinterface 12 and whose design is explained by reference to FIGS. 2 and3. The system has a plurality of firing devices which are to be firedselectively on an individual basis or in groups in the event of afront-end impact, a side impact, a roll-over etc.

[0028] The control device 2 controls a microprocessor which hasassociated memories and which determines instructions and/or informationfrom sensor input signals 22 which are generated by differentacceleration sensors, said instructions and/or information being fed tothe communications interface 6 via the data line 4.

[0029] In addition, a safing switch 26 which forms a redundancy switchand which closes by means of a predetermined vehicle deceleration sothat, when the safing switch 26 is closed, current flows from a voltagesource 28 with for example 5 volts, through a resistor 30 and the safingswitch 26 so that a safing signal is present at a safing pin or safinginput 32 of the communications interface 6 which is connected to theconnection between the safing switch 26 and the resistor 30. In parallelwith the safing switch 26 there is a normally open bypass switch 34which is formed, for example, by a transistor and which is connected toa voltage divider circuit formed from two resistors 36 and 38 connectedin series. The one resistor 38 is connected to ground and the otherresistor 36 is connected to a test output 40 of the control device 2,which is in turn connected to a test input 42 of the communicationsinterface 6.

[0030] The connection between the safing switch 26 and the resistor 30is additionally connected to an input 44 of the control device 2.

[0031] The control device 2 also has a control output 46 which isconnected to a further pin or a control input 48 of the communicationsinterface 6.

[0032] The design and function of the individually described componentsand function blocks are known per se and are not explained.

[0033] The transmission of the information of the instructions of thecontrol device 2 and of the signal states of the inputs 32, 42 and 48which are sent via the data line 4 takes place in a manner known per se,it being possible for this data to be checked for correctness in amanner known per se by means of the division of the individual codewords into information packets and check packets. If it is detected, forexample, in the communications interface 6 that the input 42 has asignal applied to it, but this is not the case at the input 32, a faultin the system can be identified immediately by acknowledgement by thedata line 4 to the control device 2. Furthermore, the control device 2can be embodied, for example, in such a way that it sends a firinginstruction for firing the firing device 18 or devices 18 only if asafing signal is present at its input 44. Furthermore, the transmissionof a firing instruction can additionally be protected by the fact that afiring pulse is transmitted only after a signal change has been detectedat the input 44 or at the input 32 without a signal change being presentat the input 42.

[0034] If, for example in the case of test signal generated as a resultof a fault in the control device 2, i.e. test input 42 with a signalapplied to a firing signal is transmitted via the data line 4, this doesnot cause the firing device to fire as explained below because the testinput 42 forms a DISABLE input. In this way, it is at least largelypossible to prevent faults in the firing device 2 leading to inadvertentfiring of a firing device.

[0035] The design of an advantageous exemplary embodiment of the firingdevices 9, 10 which are advantageously embodied in the same way isdescribed below with reference to FIG. 2.

[0036] The communications interface 12 which is connected to thecommunications bus 8 has a safing output 32 ₁, a test output 42 ₁, and acontrol output 48 ₁. The code words which are transmitted via thecommunications bus 8 are each read out by the communications interface12 in such a way that the signal state at the outputs 32 ₁, 42 ₁ and 48₁ corresponds to the signal states at the inputs 32, 42, 48 of thecommunications interface 6.

[0037] In the firing device 16 there is a switching device 50 whoseinputs are connected to the outputs 32 ₁ and 48 ₁. A firing signaloutput 52 of the communications interface 12, to which firing signaloutput 52 a firing signal sent by the control device 2 via the data line4 is transmitted, is connected to a firing input 53. A code input 54 isconnected to a code signal output 55 which conducts identificationsignals and code signals which are individually assigned to the firingdevices and are transmitted by the control device 2.

[0038] The firing devices are each provided with an individual code, forexample by programming a memory contained in them so that they detect acode signal which is respectively assigned to them.

[0039] The coding of a firing device can also be carried out by virtueof the fact that a resistor, at which a predetermined voltage drops whenthe code signal is present, is connected downstream of the code input54, said voltage serving to activate a code switch. The presence orintactness of such a resistor can be checked from the control device 2,as a result of which the functional reliability of the system is furtherimproved.

[0040] The further design and function of the switching device 50 isexplained with reference to FIG. 3:

[0041] The input of a code switch 56 is connected to a firing voltagesource 58. The code switch 56 has two outputs, of which one is connectedto the input of a firing switch 60 via a control switch 56 which can bedriven by the control output 48 ₁, and the other is connected to theinput of the firing switch 60 via a safing switch 61 which can be drivenfrom the safing output 32 ₁. The output of the firing switch 60 isconnected to a firing unit 62, embodied for example as a firing cap.

[0042] The function of the switching device 50 which is described issuch that the code signal present at the input 54 defines thecontrol-device-specific positioning of the code switch 56, i.e. whetherthe branch with the control switch 59 or the branch with the safingswitch 61 is activated. When the control switch 59 is activated, acontrol signal which is present at the control output 48 ₁ leads to theclosing of the control switch 59 so that a firing signal 53 which closesthe firing switch 60 fires the firing unit 62 when the firing voltagesource 58 is charged. On the other hand, when the safing switch 61 isactivated, a signal at the safing output 32 ₁ causes the firing output62 to fire when there is a firing signal.

[0043] If a plurality of firing devices equipped with the controlcircuit 50 described are connected to the communications bus 8, it istherefore possible to determine by means of the code signal whether thefiring devices are activated via the control output 48 ₁ and/or thesafing output 32 ₁ so that they fire correspondingly.

[0044] An exemplary assignment is that firing devices which areactivated via the control output 48 ₁ are firing devices which fire whenthere is a side impact, whereas firing devices which are to fire in theevent of a front-end impact are activated via the safing output 32 _(1.)The switches 59 and 61 thus constitute, in a certain way, safingswitches which are assigned to a side impact or a front-end impact. Inaddition, the firing device contains a safety switching device 63 withan AND element 64 whose inputs are connected to the firing voltagesource 58 and the test output 48 ₁ and whose output is connected to theinput of a safety switch 66 which is formed, for example, from atransistor. The safety switch 66 connects the safing output 32 ₁ toground when there is a signal from the AND element 64 so that a signalwhich is present at the safing output 32 ₁ becomes ineffective for theswitching device 50. In order to monitor the state of the safety switch66 or of the safing output 32 _(1,) a monitoring device 68 is providedwhose output signal is displayed immediately and/or can be sensedadditionally by the control device 2.

[0045] The design and function of the individual assemblies orfunctional elements are known per se and are therefore not explained inparticular.

[0046] The function of the safety device 63 is explained below. It isassumed here that, after the system is switched on, for example via thecommunications bus 8. the firing voltage source 58 is gradually chargedto the firing voltage.

[0047] The safing output 32 ₁ may have a safing signal (front-endimpact) applied to it so that when there is a corresponding code theswitch 61 is closed and the firing unit 62 fires when there is a firingsignal if the test output 42, does not have a signal applied to it.However, if a test signal is present and the firing voltage source 58 ischarged to its firing voltage, the AND element 64 supplies an outputsignal, as a result of which the safety switch 66 closes and connectsthe safing output 32 ₁ to ground, as a result of which in turn theswitch 60 is prevented from closing. A test signal thus constitutes anENABLE signal in terms of the firing. If the firing voltage source 58has still not reached the firing voltage after the system is put intooperation (the firing voltage source 58 contains a charging capacitor),the AND element 64 does not supply an output signal because there isinequality between the voltage at the test output 42 ₁ and the voltageof the firing voltage source 58 in this state. It is in any caseimpossible for the firing device 18 to fire with inadequate voltage.However, by using a firing pulse or test pulse generated by the controldevice it is possible to test the firing unit 68 because the switches56, 61 and 60 bring about a current path from the voltage source 58 tothe firing unit 62. If a plurality of firing devices are connected inaccordance with FIG. 2 to the communications bus 8 in FIG. 1, a vehicleoccupant protection system can thus be brought about in which a numberof firing devices (closed switch 61) fire only when there is a front-endimpact (safing output 32 ₁), and other firing devices (switch 59 closed)fire when there are impacts other than front-end impacts, the firing ofsaid firing devices being secured via the control output 48 _(1.) Thecontrol devices which fire when there is a front-end impact can beadditionally checked in terms of their function using the test output 32_(1,) firing being reliably prevented when there is a functional check.

[0048] It goes without saying that the system described can be changedin different ways. For example, it is not absolutely necessary tointegrate a firing-device-specific identification; however, it increasesthe flexibility of the system because firing devices can be addressedselectively. The switching device 50 can contain a plurality of switchesso that it is possible, for example, to fire all the firing devices inthe case of a front-end impact, whereas only respectively assignedfiring devices are fired in the case of other impacts. Alternatively, itis also possible to use other firing devices which are connected to acommon communications interface 12.

[0049] The firing input 53 can be dispensed with if the firing signalcomes directly via the output 48 ₁ or 32 ₁ and closes correspondingswitches which connected the firing voltage source to the firing unit.

[0050] It goes without saying that the block circuit diagram in FIG. 2is also schematic and can be modified in various ways. For example, aplurality of firing units may be provided per firing device. FIG. 4shows a modified embodiment of the system according to FIG. 1, the samereference symbols being used for functionally similar parts

[0051] The essential difference from the embodiment according to FIG. 3and that according to FIG. 1 is that in the embodiment according to FIG.3 the test input 42 is absent and in its place the test output 40 isconnected via a further voltage divider circuit with resistors 70 and 72to a switch 74 which is formed, for example, by a transistor, can beactuated electronically and is connected to the control input 48.

[0052] The circuit ensures that when a test pulse generated by thecontrol device 2 is present at the test output 40 or when there is apulse at the output 40 (which does not necessarily need to be a testoutput) for closing the switches 34 and 74 at the inputs 32 and 48, ineach case the same voltages or signals are present as when the safingswitch 26 closes or when there is a control signal present at thecontrol output 46.

[0053] With only two pins or inputs 32 and 48 of the communicationsinterface 6 to which corresponding outputs 32 ₁ and 48 ₁ of the decodingdevice 10 correspond, it is possible to secure four functional scopes,for example according to the following table; Safing Control State input32 input 48 Enabling/disabling I 0 0 Enabling test Firing in case offront-end impact II 0 1 Enabling firing in case of non-front- end impactIII 1 0 Disabling of all firings IV 1 1 Enabling of all firings

[0054] As is apparent, the firing device or devices which are assignedto a front-end impact can be tested and the firing device or deviceswhich are not assigned to a front-end impact can be fired independentlyof the firing devices to be fired in the event of a front-end impact Theoutput 40 in the embodiment according to FIG. 3 is therefore not a testoutput in the true sense but rather an additional control output withwhich functions can be disabled or enabled.

[0055] The circuit of the firing device or devices is correspondinglyembodied so that the corresponding functions can be disabled or enabledwith the signal states explained in table 2 at their outputs 32 ₁ and 48₁.

[0056] It goes without saying that the circuits which are explained byway of example can be modified in various ways if only the essentialideas of the invention are implemented, i.e. the generation of signalstates at the control-device-end communications interface 6 which aretransmitted via the communications bus 8 to the communications interface12 and are available there for disabling or enabling functional stateswhich are triggered by means of corresponding instructions. An input ofthe control-device-end communications interface is connected to a safingswitch, it being possible to bypass the safing switch by means of abypass switch which can be driven by an output of the control device.The output of the safing switch is connected to an input of the controldevice, it being possible, in contrast to the embodiments illustrated,for this input to be inverting, i.e. to have the voltage zero applied toit when the safing switch is closed.

[0057] An output-end control device has a device with which it ispossible to test a firing device with predetermined application ofsignals to the outputs of the firing-device-end communications interfaceas long as the voltage source has not yet reached its firing voltage,and in the state in which the test capability is enabled the firingcapability is automatically disabled as soon as the voltage source hasreached its firing voltage.

[0058] Alternatively, the communications interface of the firing devicescan, as shown in FIG. 2, be embodied with three outputs, and theapplications of signals to the inputs 32 and 48 of the control device ofFIG. 4, which are transmitted via the communications bus, can beconverted into the following applications of signals by appropriatelyembodying the communications interface 12: K-interface 6 K-interface 12(FIG. 4) (FIG. 2) State 32 48 32₁ 48₁ 42₁ I 0 0 1 0 1 II 0 1 1 1 0 III 10 0 0 0 IV 1 1 0 1 0

[0059] As a result, with the embodiment of the control device and of thecircuits connected downstream of it according to FIG. 1 and theembodiment of the firing device according to FIG. 2 it is possible tocarry out all the functions explained in conjunction with these figures.

[0060] Only two additional bits contained in the code words have to betransmitted via the communications bus, said bits corresponding in eachcase to one of the inputs 32 and 48 and their signal state being asindicated in the table above. The information contained in the (controland signal) bits is converted in the communications interface 12 intothe application of signals to the outputs 32 ₁, 48 ₁ and 42 ₁ which isindicated in the table.

1. A system for controlling the operation of modules by transmittinginformation from a control device via a databus, in particular forcontrolling the operation of firing devices of a vehicle occupantprotection apparatus in a motor vehicle, containing a communicationsinterface (6) which is connected to the control device (2) via a dataline (4) and has an input (32), which communications interface convertsdata transmitted by the control module into code words which aretransmitted via the communications bus (8) and which contain informationrelating to the data and the signal state of the input (32),characterized in that the communications interface (6) which isconnected to the control device (2) has a plurality of inputs (32, 42,48) to which signals can be applied, and in that the communications bus(8) is connected to the modules (18, 20) via a module-end communicationsinterface (12) which has a plurality of outputs (32 ₁, 42 ₁, 48 ₁) towhich signals can be applied, the signal state of the inputs beingtransmitted to the outputs via the communications bus (8) in such a waythat there is a predetermined relationship between the signal states ofthe inputs and outputs, as a result of which functions of the modules(18, 29) can be disabled and enabled by means of the signal states ofthe inputs.
 2. The system as claimed in claim 1, characterized in thatthe communications interface (6) which is connected to the controldevice (2) has a safing input (32) which is connected to a safing switch(26) and a control input (42) which is connected to a control output(46), to which a control signal can be applied, of the control device(2), and in that the communications bus (8) is connected to the modules(18, 20) via a module-end communications interface (12) which has asafing output (32 ₁) and a control output (48 ₁), the signal state ofthe safing input or of the control input being available at the safingoutput or the control output in order to disable or enable functions ofthe modules (18, 20).
 3. The system as claimed in claim 1 or 2,characterized in that the modules can be addressed selectively by meansof a code.
 4. A system for controlling the operation of modules bytransmitting information from a control device via a databus, inparticular for controlling the operation of firing devices of a vehicleoccupant protection apparatus in a motor vehicle, containing acommunications interface (6) which is connected to the control device(2) via a data line (4) and has a safing input (32) connected to asafing switch (26), which communications interface converts datatransmitted by the control module into code words which are transmittedvia the communications bus (8) and which contain information relating tothe data and the signal state of the safing input, characterized in thatthe control device (2) has a test output (40) to which a test signal canbe applied from said control device (2) and which is connected to afurther input (42, 48) of the communications interface (6), and in thata bypass switch (34) is provided parallel to the safing switch (26) insuch a way that when the test signal generated by the control device ispresent a signal state corresponding to the closed safing switch ispresent at the safing input (32) irrespective of the switch state of thesafing switch, and in that the communications bus (8) is connected tothe modules (12, 20) via a module-end communications interface (12)which has a safing output (32 ₁) and at least one further output (42 ₁,48 ₁ ), the signal state of the safing input or of the further inputbeing available at the safing output or further output in order todisable or enable functions of the modules.
 5. The system as claimed inclaim 4, characterized in that the test output (40) of the controldevice (2) is directly connected to a test input (42) of thecommunications interface (6), and the further output of the module-endcommunications interface (12) is formed by a test output (42 ₁).
 6. Thesystem as claimed in claim 5 and one of claims 1 to 3 for a vehicleoccupant protection system of a motor vehicle, characterized in thatsafety devices (18) which trigger when there is a front-end impact canbe triggered only when the safing switch (26) is closed and safetydevices (20) which trigger when there is a side impact can also triggerwhen the safing switch is open. 7 The system as claimed in claim 6,characterized in that when a test signal is present the triggeringcapability of the safety devices (18) which trigger when there is afront-end impact is disabled.
 8. The system as claimed in claim 4,characterized in that the control input (48) is connected to the testoutput (40) via a switching device (74) in such a way that when there isa test signal present a signal state which corresponds to the presenceof a control signal is present at the control input.
 9. The system asclaimed in claim 8 for a vehicle occupant protection system in a motorvehicle, characterized by the following relationship between the signalstates at the inputs of the control-device-end communications interfaceand the possibility of enabling or disabling functions: Safing ControlState input 32 input 48 Enabling/disabling I 0 0 Enabling test Firing incase of front-end impact II 0 1 Enabling firing in case or non-front-end impact III 1 0 Disabling of all firings IV 1 1 Enabling of allfirings


10. The system as claimed in one of claims 1 to 9, characterized in thatthe control-device-end communications interface (6) transmits the signalstate of its inputs to the control device (2) .
 11. A firing device forconnection to the communications bus of a system as claimed in claim 3for a vehicle occupant protection apparatus in a motor vehicle,characterized by the communications interface which can be connected tothe communications bus (8) and has a safing output (32 ₁), the controloutput (48 ₁), a code signal output with a firing signal output, aswitching device (50) which has a safing switch (61) which can beactivated by the safing output (32 ₁), a control switch (59) which canbe activated by control output (42 ₁), a code input (54) with a firinginput, a firing-device-specific code signal present at the coding inputdetermining which of the switches is activated, and a firing signalleading to firing of a firing unit when the safing switch is activatedand a safing signal is present and/or control switch is activated and/ora control signal is present, a safety circuit (62) with an AND element(64) whose inputs are connected to the test output (42 ₁) and to thefiring voltage source (58) and whose output is connected to a safetyswitch (66) which connects the safing output to ground if a test signalis applied to the test output and the firing voltage source has avoltage which is not sufficient to fire the firing unit.
 12. A firingdevice for connection to the communications bus of a system as claimedin claim 5 for a vehicle occupant protection device in a motor vehicle,characterized by the communications interface which can be connected tothe communications bus (8) and has the safing output (32 ₁), the testoutput, safing switch (61) which can be activated by the safing output(32 ₁) and which connects a firing voltage source (53) to a firing unit(62) when there is a signal at the safing output and a firing signal ispresent, and a safety circuit (63) with an AND element (64) whose inputsare connected to the test output (42 ₁) and to the firing voltage source(58) and whose output (32 ₁) is connected to a safety switch (66) whichconnects the safing output to ground if a test signal is applied to thetest output and the firing voltage source has a voltage which is notsufficient to fire the firing unit.
 13. The system as claimed in claim11, characterized in that a monitoring device (68) for the safety switch(66) is provided
 14. A safety circuit for a firing device of a vehicleoccupant protection system, containing an input (32 ₁) to which a signalcan be applied and a test input (42 ₁) to which a test signal can beapplied and an AND element (64) whose inputs are connected to the testoutput and to a firing voltage source (58) and whose output is connectedto a safety switch (66) which connects the input (32 ₁) to ground if atest signal is applied to the test output (42 ₁) and the firing voltagesource (58) has a voltage which is not sufficient to fire the firingunit.